Questions[ipv6](server)

I have an nginx server serving up nearly half a dozen different websites. It's running on a Linode that just got IPv6 native support (Dallas data center), and I'm trying to configure most of my sites for dual-stack operation. I got the first one up and running using an IPv6-only subdomain like so:

server {
    listen [::]:80 ipv6only=on;
    listen 80;

    server_name example.com ipv6.example.com;

    root /var/www/example.com/htdocs;

    #More stuff, including PHP, WordPress
}

This works great -- example.com is IPv4-only (for now), and ipv6.example.com is IPv6-only (primarily there for testing purposes). I can ping6 ipv6.example.com, and even wget ipv6.example.com without breaking a sweat -- this much was pleasantly pain-free (after finding the "gotcha" with the way nginx binds virtual hosts, necessitating the ipv6only=on argument and the dual listen directives).

However, I'm now trying to expand this to support my other domains, starting with static.example.com; when I take the same approach as above, though (the dual listen directives, including the ipv6only=on argument), I get the following error when restarting nginx:

* Starting Nginx Server...
nginx: [emerg] a duplicate listen options for [::]:80 in /etc/nginx/sites-enabled/example.com.conf:3

It seems that perhaps nginx's method of binding for IPv6 doesn't permit name-based virtual hosts? Will I have to get additional IPv6 addresses from my host (not a problem) and use IP-based virtual hosting on IPv6 with named-based virtual hosting over IPv4? Or am I missing a solution that will allow my configurations to remain consistent on both stacks?

I was hoping to have my site fully on the IPv6 stack in time for World IPv6 Day, but unless I can clear this up quickly I may not be ready. Not a big deal from any practical standpoint -- none of my sites qualify as a "major organization" by any stretch of the imagination -- but help me save my geek cred!

Edited to add:

Thanks to the answer from @kolbyjack, I have a fully functional dual-stack web server now. Just for clarity's sake, I'm editing in the solution he gave me so everyone can see clearly what the answer is.

My default catchall vhost has the following listen directives:

listen 80 default_server;
listen 8080 default_server;
listen [::]:80 default_server ipv6only=on;
listen [::]:8080 default_server ipv6only=on;

I don't know if the order matters, but there it is. Then, each additional vhost has the following listen directives:

listen 80;
listen [::]:80;

(Or 8080 for the one that listens on that port instead.) The important part here appears to be the total lack of any additional arguments on all but the default vhost's listen directives -- i.e. no repetition of ipv6only=on.

Again, much thanks to @kolbyjack for the solution here!

Of course, I realize the need to go to IPv6 out on the open Internet since we are running out of addresses, but I really don't understand why there is any need to use it on an internal network. I have done zero with IPv6, so I also wonder: Won't modern firewalls do NAT between internal IPv4 addresses, and external IPv6 addresses?

I was just wondering since I have seen so many people struggling with IPv6 questions here, and wonder why bother?

IPv4 can broadcast. Why can't IPv6 do that?

URLs always have this format:

<protocol>://<host>[:<port>]/[<path>][#<hash>]

The problem is that IPv6 uses colons, just like the separator of port and host, e.g:

2001:db8:1f70::999:de8:7648:6e8

But what if this is the host, and I want to connect to it with HTTP on port 100?

http://2001:db8:1f70::999:de8:7648:6e8:100/

The problem is the last colon. Since zero's are omitted with double colons (between 1f70 and 999), it's unknown if ':100' belongs to the IP or the port number. How can we know this?

This is a Canonical Question about IPv6 and NAT

Related:

• How does IPv6 subnetting work and how does it differ from IPv4 subnetting?
• How can I 'dip my toes' into dynamic IPv6 network addressing?
• IPv6 without nat but what about an isp change?

So our ISP has set up IPv6 recently, and I've been studying what the transition should entail before jumping into the fray.

I've noticed three very important issues:

1. Our office NAT router (an old Linksys BEFSR41) does not support IPv6. Nor does any newer router, AFAICT. The book I'm reading about IPv6 tells me that it makes NAT "unnecessary" anyway.

2. If we're supposed to just get rid of this router and plug everything directly to the Internet, I start to panic. There's no way in hell I'll put our billing database (With lots of credit card information!) on the internet for everyone to see. Even if I were to propose setting up Windows' firewall on it to allow only 6 addresses to have any access to it at all, I still break out in a cold sweat. I don't trust Windows, Windows' firewall, or the network at large enough to even be remotely comfortable with that.

3. There's a few old hardware devices (ie, printers) that have absolutely no IPv6 capability at all. And likely a laundry list of security issues that date back to around 1998. And likely no way to actually patch them in any way. And no funding for new printers.

I hear that IPv6 and IPSEC are supposed to make all this secure somehow, but without physically separated networks that make these devices invisible to the Internet, I really can't see how. I can likewise really see how any defences I create will be overrun in short order. I've been running servers on the Internet for years now and I'm quite familiar with the sort of things necessary to secure those, but putting something Private on the network like our billing database has always been completely out of the question.

What should I be replacing NAT with, if we don't have physically separate networks?